On 6 May 2016, at 9:05, Todd Herr wrote:
On Thu, May 5, 2016 at 10:10 PM, Dave Warren <[email protected]>
wrote:
Given that RFC 821 is from August of 1982, I would wholeheartedly
recommend unplugging them until they catch up to at least 1984, or if
that's not possible, at least disable the SMTP-breaking "feature".
Even
Microsoft published a how-to article on the topic:
https://support.microsoft.com/en-us/kb/320027
Yes, while I appreciate the sentiment, the PIXen are not mine to
unplug.
Unfortunately, there's no general solution to the problem from the "not
my PIX" side of this problem. If you use Postfix, there's a *PARTIAL*
fix in the smtp_pix_workarounds feature, but ultimately the only way to
make mail work reliably through a PIX or ASA firewall is to turn off its
misguided and fundamentally broken manipulation of SMTP.
And on the bright side: if this is an actual PIX, it stands a strong
chance of being so compromised in the near future that unplugging is the
only rational fix. Cisco stopped putting out fixes for them some years
ago, but well-documented vulnerabilities did not cease to be found and
fully disclosed.
_______________________________________________
mailop mailing list
[email protected]
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
